# WAF

> The OpenWAF web application firewall inspects every request to a proxied name on the edge, with OWASP CRS, OpenWAF rules, shields and rate limits.

Every request to a proxied name is inspected on OpenWAF's edge nodes in Germany and Spain before it reaches your origin. The WAF combines:

- **OWASP CRS 4.25** running on Coraza, plus OpenWAF's own rules (sensitive files, path traversal, encoding evasion, request smuggling, scanner fingerprints) and emergency virtual patches for new CVEs.
- **Stack shields**: eight targeted protections such as SSRF, open redirects, source maps and GraphQL introspection, each one switchable per path.
- **Threat-intelligence feeds** that block addresses of known attackers.
- **IP and country rules**, **rate limiting** and an **access gate** that protects admin paths with one-time codes sent by email.

You choose per zone, or per name, how strict the WAF is and whether it blocks or only records.

- [Get started](https://developers.openwaf.dev/waf/get-started/): start in log-only mode, review what would be blocked, then protect.
- [Modes and levels](https://developers.openwaf.dev/waf/modes-and-levels/): active, log-only or off, and what the low, medium and high levels mean.
- [How a request is processed](https://developers.openwaf.dev/waf/request-processing/): the order in which the edge applies every check.
- [Stack shields](https://developers.openwaf.dev/waf/shields/): the eight shields, their ids and what they block.
- [Threat feeds](https://developers.openwaf.dev/waf/threat-feeds/): curated lists of attacker addresses, on by default.
- [Browser challenge](https://developers.openwaf.dev/waf/browser-challenge/): the proof-of-work page that real browsers pass automatically.
- [WAF exceptions](https://developers.openwaf.dev/waf/waf-exceptions/): switch a rule or a shield off on a path when it blocks legitimate traffic.
- [IP and country rules](https://developers.openwaf.dev/waf/ip-and-country-rules/): allow or block addresses, ranges and countries.
- [Rate limiting](https://developers.openwaf.dev/waf/rate-limiting/): limit requests per IP, header, cookie or JSON field on a path.
- [Access gate](https://developers.openwaf.dev/waf/access-gate/): put an admin area behind one-time codes sent by email.
- [Block page](https://developers.openwaf.dev/waf/block-page/): choose what blocked visitors see.
- [Settings reference](https://developers.openwaf.dev/waf/settings/): every WAF setting, its values and its default.
- [Rule reference](https://developers.openwaf.dev/waf/rule-reference/): the four rule kinds and their fields.
- [Edge responses and headers](https://developers.openwaf.dev/waf/responses/): status codes the edge answers and headers it adds or removes.
- [Troubleshooting](https://developers.openwaf.dev/waf/troubleshooting/): false positives, blocked WordPress logins, large uploads.


## Where to find it

| Interface | Settings | Rules |
|---|---|---|
| Dashboard | Domain → **Security → Firewall**, **Security → Rate limiting**, **Security → Access gate** | **Security → Firewall → Rules** |
| CLI | `zones show`, `zones set`, `ratelimit list/add/set/rm` | `rules list`, `rules add`, `rules rm` |
| API | `GET/PATCH /v1/orgs/{org}/zones/{zone}/edge` | `GET/POST /v1/orgs/{org}/zones/{zone}/rules`, `DELETE …/rules/{rule}` |
| MCP | `get_zone`, `update_settings`, `effective_config` | `list_rules`, `add_rule`, `remove_rule` |

Every change is versioned: it is simulated first, needs a reason and can be reverted. See [Change control](https://developers.openwaf.dev/change-control/). Blocked and logged requests appear in [security events](https://developers.openwaf.dev/analytics/security-events/).